CVE-2026-117558

The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying shell metacharacters in the repo argument. The unvalidated repo value is interpolated into gh issue view or gh pr view commands run via execSync,...

CVE-2026-117499 @fastify/session vulnerable to session revocation bypass via a logout race condition

@fastify/session is a session plugin for Fastify. In all releases before 11.1.6, with the default rolling session behavior, a request that restored a session before a logout could save its own copy after another request had completed the session destroy call, recreating the destroyed session...

CVE-2026-117534

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or...

CVE-2026-117532

REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin...

CVE-2026-117534

REDAXO versions prior to 5.21.3 are vulnerable to a cross-site request forgery (CSRF) vulnerability within the structure/history plugin . The root cause is the use of unvalidated GET requests to perform sensitive actions. An attacker can lure authenticated backend users to a malicious page that t...

EUVD-2026-110799

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or...

CVE-2026-117534 REDAXO before 5.21.3 CSRF in Article History Plugin

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or...

CVE-2026-117534 REDAXO before 5.21.3 CSRF in Article History Plugin

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or...

EUVD-2026-110797

REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin...

CVE-2026-117532 REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin

REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin...

CVE-2026-117532

REDAXO core versions 5.3.0 through 5.21.4 are vulnerable to an authentication bypass within the structure/history plugin. This flaw allows unauthenticated attackers to force the session-tied secret into a predictable state , enabling the forgery of temporary login tokens. An attacker can leverage...

CVE-2026-117532 REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin

REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin...

CVE-2026-117532 REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin

REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin...

SECURITY-3314-3315

= SECURITY-3314/SECURITY-3315 Mitigation This repository documents mitigations preventing exploitation of SECURITY-3314 and SECURITY-3315 on affected instances. == Overview Access to the CLI needs to be disabled. Both of the following steps must be taken: Remove the CLI HTTP endpoint Disable the...

WordPress Login with phone number plugin <= 1.8.78 - Broken Authentication vulnerability

Broken Authentication vulnerability discovered by Peter Tang in WordPress Plugin Login with phone number versions = 1.8.78...

WordPress Payment Integration Wompi plugin <= 4.0.1 - Unauthenticated Payment Confirmation Forgery vulnerability

Unauthenticated Payment Confirmation Forgery vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Payment Integration Wompi versions = 4.0.1...

PT-2026-126369

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or rex history...

REDAXO CMS core cross-site request forgery vulnerability

REDAXO CMS versions prior to core 5.21.3 contain a cross-site request forgery vulnerability. This flaw stems from the structure/history plugin’s failure to validate GET requests, making it susceptible to such attacks. It could allow attackers to trick logged-in users into triggering func=clearall...

Spesmilo Electrum encryption issue vulnerability

Versions prior to spesmilo electrum 4.7.2, specifically 4.6.0, contain an encryption-related vulnerability. This flaw arises because the external plugin loader executes the init.py module marked as enabled without first verifying the plugin’s password signature. As a result, malicious local...

REDAXO CMS core authorization issue vulnerability

Versions of REDAXO CMS prior to core 5.21.5 contain an authorization issue vulnerability. This flaw stems from the backup plugin’s export functionality lacking proper authorization checks; it allows unrestricted export of database tables. Non-administrative users possessing the backupexport...